KEY — keys another program reaches the stack with

Raised by lemonfiber key, and where a key is minted, listed or revoked through the web API. A key belongs to a program rather than a person — Home Assistant, an assistant, a script — and has one scope: read, act or member:<account>. See the commands.

Code	Severity	Exit	What it means	What to do
KEY-1	error	1	That word cannot name a key. A key's name travels in an address, an alert and the journal, so it is lower-case letters, digits, dots, dashes and underscores, beginning with a letter or a digit, and at most 64 characters.	Name it as the program that holds it, as in home-assistant.
KEY-2	error	1	That is not a scope a key can have. A key has exactly one scope, and it decides everything the key admits.	Give it one of read, act or member:<account>.
KEY-3	error	1	That is not a purpose a key can carry. A key says what it is for, so the listing can tell keys apart.	Give it one of home-assistant, mcp or other.
KEY-4	error	1	The record of this machine's keys is there and does not read as keys. Nothing is written over it, because it may still hold keys somebody depends on, and every key it held is refused until it reads again. The message names the file.	Look at the file, and move it aside if it is damaged.
KEY-5	error	1	A key by that name already exists, active or revoked. A name identifies one key for good, so an alert or a journal entry naming it always means the same key.	Mint it under another name.
KEY-6	error	1	Nobody in the household goes by that name. A member's key admits exactly what that member's own account does, so it is minted for an account the household holds.	Name them as they appear in the household, as lemonfiber household lists it.
KEY-7	error	1	The household could not be asked about that account, because the media server did not answer, so nothing was minted. A member's key is minted for an account the media server holds.	Try again once the media server is running.
KEY-8	warning	1	A household member mints and revokes only keys of their own. A member's key admits what their own account does and nothing more, so the only key a member may mint or revoke is one scoped to themselves.	Ask for member:<your own account>, or ask whoever looks after this machine.
KEY-9	error	1	lemonfiber could not mint a secret for that key. A key's secret is unpredictable bytes this machine supplies, and it would not supply them, so nothing was minted.	Try again. If it happens twice, the operating system's own random source is at fault.
KEY-10	error	1	There is no active key by that name: none was minted under it, or it was revoked already, and the message says when.	List the keys with lemonfiber key list, and revoke one by the name it shows.
KEY-11	warning	1	Whoever looks after this machine has not allowed household members to mint keys, so nothing was minted. A member's key carries that member's requests and viewing to whatever program holds it, so minting one is something the operator allows first.	Ask whoever looks after this machine to allow it, with lemonfiber config set LEMONFIBER_MEMBER_KEYS on.
KEY-12	warning	1	That claim collects no key: no key was minted with it, it collected its key already, or its ten minutes have passed. Which of the three is not said, so a guess learns nothing.	Ask whoever looks after this machine to mint the key as a claim again, and collect it within ten minutes.
KEY-13	warning	1	A claim is collected by another machine, over the address and certificate its link carries, and this stack has not been served where another machine reaches it, so there is no link to write. Nothing was minted.	Serve the stack encrypted on the network first, then mint the key as a claim again.

What each severity and each exit means is on every error by code, beside every other family.